Mumbai CSMT Cyber Scam: Fake RTO APK, Free Wi-Fi Malware Attack Dupes Bank Official of INR 4.27 Lakh
Mumbai Police have launched an investigation into a sophisticated cyber fraud case in which a senior official at a nationalised bank was duped of ₹4.27 lakh. Investigators suspect the security breach originated when a personal secretary connected his smartphone to the free public Wi-Fi network at Chhatrapati Shivaji Maharaj Terminus (CSMT).
Mumbai Police have launched an investigation into a sophisticated cyber fraud case in which a senior official at a nationalised bank was duped of ₹4.27 lakh. Investigators suspect the security breach originated when a personal secretary connected his smartphone to the free public Wi-Fi network at Chhatrapati Shivaji Maharaj Terminus (CSMT).
According to the MRA Marg police, the victim, 56-year-old Gobinda Biswas—a resident of Wadala and General Manager at a nationalised bank’s Fort office—received a message on July 18 from his personal secretary, Narayan Swami. The message appeared to contain an official Regional Transport Office (RTO) traffic challan attached as an Android Application Package (APK) file. What Is ‘RTO E-Challan’ APK Scam? Fake File Circulating on WhatsApp May Hack Your Mobile Phone, How To Stay Safe.
Polices stated that prior to the message being sent, Swami had connected his device to the public Wi-Fi network at CSMT. Investigators believe cybercriminals compromised Swami’s phone—either through the open public network or via a rogue hotspot mimicking the official Wi-Fi—and installed malware. The malicious software then automatically broadcast the fake RTO challan APK file to over 200 contacts stored on the device.
Trusting the message coming from his secretary’s number, Biswas downloaded and installed the application onto his phone. The malware subsequently gained unauthorized access to sensitive personal and financial data stored on his device, enabling fraudsters to execute unauthorized transactions totaling ₹4.27 lakh from his credit card.
The MRA Marg police have registered a First Information Report (FIR) under relevant sections of the Information Technology Act and the Bharatiya Nyaya Sanhita (BNS). Cyber investigators are currently tracing the digital footprint of the APK file and verifying the exact entry point of the malware on the public network. Bengaluru Online Scam: Man Loses INR 56,000 After Downloading ‘Free Movie’ APK on WhatsApp.
This incident highlights growing concerns among cybersecurity experts regarding public Wi-Fi networks and "smishing" (SMS/messaging phishing) campaigns using malicious APK files. Security agencies regularly advise citizens to avoid connecting to unencrypted public Wi-Fi for sensitive tasks and to refrain from downloading third-party APK files received via messaging applications.
(The above story first appeared on LatestLY on Aug 07, 2026 12:53 PM IST. For more news and updates on politics, world, sports, entertainment and lifestyle, log on to our website latestly.com).
